MySQL error when inserting apostrophe

[nick354316]

I am using the Validation Toolkit applying client side validations which include validating the company name of the visitor on the registration page. The company form is being validated as Alphanumeric, with &.,'-_" allowed.

I am allowed to click on the Register button, but receive the following error on the next page: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's in the market'' at line 1."

I can remove the company validation requirement and the registration goes through as long as the entry is left blank.

And logically, if I eliminate the company element altogether (unacceptable), the registration goes through.

If I enter Matt's as a company name (validation required or not), I get the error. If I enter Matts, without the apostrophe, I do not get the error. As company names often have apostrophes in them, this is obviously unacceptable.

The apostrophe works in the Billing Name field, and the Password field. All well and good, but I need the company name to work with the apostrophe.

Everything worked on the registration form prior to the validations.

I have attached a zip file containing the Registration page.

Please help.

[Eric Mittman]

The error you are getting is a MySQL error, it is coming from your db, not the validation toolkit. It looks like this could be coming from the 'Check new Username' server behavior.

What is the data type of the UserCompanyID column in your table? Give the following a try to see if it allows you to get past this issue.

Update line 38 from this:

$LoginRS__query = "SELECT UserCompanyID FROM users WHERE UserCompanyID='" . $loginUsername . "'";


to this:

$LoginRS__query = "SELECT UserCompanyID FROM users WHERE UserCompanyID=`" . $loginUsername . "`";



Post back and let us know how this works and any other details about your setup if you are still having problems.

[nick354316]

Hi Eric - Thanks for your response. The data type is varchar. I replaced the line of code on the page with the code you supplied, and I got the following error. The company name I used was Matt's.

Unknown column 'Matt's' in 'where clause'

Showing my inexperience with this, I am using the email address of the client as the username for the log in page, so I am not sure if that makes any difference.

Thank you for your help on this.

[Eric Mittman]

I opened a ticket for you on this issue so that we can look into it further and exchange some files in private. To update your ticket login and visit your support history.

http://www.webassist.com/mywebassist/supporthistory.php